GitHub App keys can still enable takeovers long after they are forgotten
GitGuardian found 474 still-valid leaked GitHub App keys that can enable repository access and organization takeovers.
73
Victim
Sierra Nevada Corporation
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 23, 2026
- Last mentionedSep 23, 2026
Timeline
2 articles · newest firstHundreds of Leaked GitHub App Keys Still Authenticate
GitGuardian found 474 leaked GitHub App private keys still authenticate, some with organization admin rights.
76
Appears with
- GitGuardianorganization · 2
- Civicaorganization · 2
- Sierra Nevada Corporationorganization · 2
- BuildBuddyvictim · 2
- GitHubvendor · 2
- GitHub Appsproduct · 2
- GitHub Actionsproduct · 2
- Centers for Disease Control and Preventionvictim · 2
- Civicavictim · 2
- Centers for Disease Control and Preventionorganization · 2
- BuildBuddyorganization · 2
- GitHuborganization · 1
- Crusher.devorganization · 1
- Crusher.devvictim · 1
- ColorTokensorganization · 1
- GitGuardianvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.